Hi Nation,Product Office Hours #8 - Jamf Setup Manager & ChecklistNext session: Thursday, 8th Oct - 10 am CDT / 4 pm BST / 5 pm CEST *please note this is one hour later than usual*Speakers: Armin Briegel, Senior Consulting Engineer ​@arminBriegel Register here: https://jamf.it/ProductOfficeHours 🧵 Got a question? Drop it in the comments below ahead of time if you want it on our radar, though you don't have to. We'll be taking questions live on the call! The Q&A transcript will be added to this thread post event.See you there!

Hi,  Has anyone has sucess with the new OS 27, Golden Gate and being to select the wifi on lock screen. It was mentioned as a new feature but it’s not working for me at this time and would be a great help in higher ed for our labs and using platform SSO for new users logging in.  Any feedback would be greatly appreciated.  Thanks!

TL;DR: Okta Platform SSO enrollment with Jamf works on an existing account, but the Identity First (Simplified Setup) PreStage flow fails with "Registration failed" before any credentials are entered. Looking for the full list of PreStage requirements, plus best practices for recovery when the Okta and local passwords diverge.ENVIRONMENT- Jamf Pro (cloud), macOS Tahoe 26.x, Apple silicon, ADE through ABM- Okta Verify 9.59.0 (enrollment package), Okta Platform SSO with password authentication- Fleet currently uses Jamf Connect Login/AuthChanger; my test Macs are excluded from both- Local admin account created by Jamf's managed local administrator (LAPS-style) settingGOALZero-touch onboarding: ship a Mac, the user signs in with Okta during setup, the local account is created and linked to Okta, and IT has a dependable recovery path if the user gets locked out.TARGET WORKFLOW1. New Mac is added to ABM, auto-assigned to Jamf, and lands in a dedicated PreStage.2. During Setup Assistant, the

First off, let me welcome you to the ⌘+? (Help), aka Help, User Group. I'm excited that you took the time to figure out what this weird symbol at the top of the user group list was. Or maybe you saw a post somewhere on LinkedIn or in one of the channels in Mac Admins and thought, "Let me take a peek.", welcome!Thank you for giving me a piece of your attention while I tell you the backstory of this group and where it came from. My name is Glenn Uhlendorf, and I have been working with Macs in some shape or fashion since about 2010. I've worked behind the Genius Bar, with Apple in education, and now I work in IT management in the enterprise field. Apple has been right there in some shape or form for all of my tech career. My current job at Consortium is Senior Manager of Information Technology, where I oversee our endpoints (using Jamf, of course) and an assortment of systems. I'm sure many of you are in the same boat.One of the values championed by my current employer is altruism, and tr

Hi Nation,Product Office Hours #7 - JNUC Keynote Recap Q&ANext session: Thursday, 1st Oct - 9am CDT / 3pm BST / 4pm CESTSpeakers: Matt Benyo, Director, Software Engineering, and Tim Knox, Senior Consulting Engineer, Industry SolutionsRegister here: https://jamf.it/ProductOfficeHours 🧵 Got a question? Drop it in the comments below ahead of time if you want it on our radar, though you don't have to. We'll be taking questions live on the call! The Q&A transcript will be added to this thread post event.See you there!

enterprise JAmf pro with the URL https://flexera.jamfcloud.com/.  package deployment is failing on the JAMF client machine. due to download issue.email: smallikarjunappa@flexera.com,hm.sushma@gmail.comClient logs: Downloading https://flexera.jamfcloud.com/jcds/v2/downloads/csia.dmg... Error: Package was not successfully downloaded. 403 The network connection was interrupted while downloading the package from https://flexera.jamfcloud.com/jcds/v2/downloads/csia.dmg. Attempting to reconnect... Downloading https://flexera.jamfcloud.com/jcds/v2/downloads/csia.dmg... Error: Package was not successfully downloaded. 403 Error: csia.dmg is not available on the HTTP server. [STEP 3 of 5] Running script dmgAgent... Script exit code: 1 Script result: Error running script: return code was 1. [STEP 4 of 5] [STEP 5 of 5]

FYIJAMF and Apple have a bug that if you have a customized enrollment and a forced major OS update in your prestage. You will more than likely will get the WSOD on your iOS 26 device and the only fix is to “Restore” it to iOS 27.  

Hi there,i have a strange issue with my Apple Configurator 2, its up to date on a macOS 27 Mac, and when i try to prepare an iPad, for exemple, i have an error telling: provisional enrollement failed without anymore explanations.I’ve read this issue might be caused by ntework but i don’t have any problem to access to internet.Is there something elese i can do? 

I had a ‘latest version’ enforcement not apply recently so I want to source the community to see if anyone else has a similar setup or came to the same conclusion. This may end in a Feature Request, but I want to understand some logistics and maybe crowd-source a solution if possible. Let’s say I want to defer my updates for a set period of time across multiple release rings (Early Adopters, GA1, GA) but I also wanted to enforce updates as well. This would create ‘update windows’ for each ring. EA opens up after 7 days and is enforced after 10 days. GA1 is a week later and GA a week after that. Blueprints - technically - provides this and its quite simple to deploy. However… I’m learning that the enforcement mechanism relies on the Apple GDMF feed which… is typically only a single version in a given OS family. Right now, it looks like this: A command-line view curling gdmf.apple.com. For Tahoe, only 26.7.1 is listed as of 6 October 2026This means the Blueprint checks against this feed

Using Jamf Pro. We have an extension attribute for App-Packs for grade levels (K-2, 3-5, 6-8). Is there an easy way to change this in bulk? I typically use MUT, but v6 doesn’t have Ext. Att as an option and Classic wont be compatible with MacOS for much longer. I even tried using the MUT on Jamf Extender but that didn’t work. Any help is appreciated. 

Hello,We are wanting to deploy software updates to our iPhones and iPads outside of business hours. However many of these devices use cellular when not onsite. A big concern is going over our data limit and being charged for overages. Is there a way to restrict OS updates to only occur if a device is connected over wi-fi?

With the help of my fellow Jamf Heroes I managed to curate a list of past JNUC venues since 2019.  I’m sure I’m forgetting some memorable ones too so help me with two things.What is your favourite venue(s) for past JNUCs, or if you were only at one what did you think of it? Fill in any past JNUC venues that I’m missing.  I believe the first JNUC was in 2010.  My first was in 2019.2019 — Minneapolis, MN Jamf Nation Party: The Minneapolis Depot Jamf Heroes Party:  Lakes and Legends Brewing Company 2022 — San Diego, CA Jamf Nation Party: USS Midway Jamf Heroes Party:  Storyhouse Spirits 2023 — Austin, TX Jamf Nation Party: Troublemaker Studios Jamf Heroes Party: Moonshine Bar & Tavern 2024 — Nashville, TN Jamf Nation Party: Assembly Food Hall Jamf Heroes Party: Teddy’s Tavern Rocketman Tech Party: Up-Down Nashville 2025 — Denver, CO Jamf Nation Party: McGregor Square Jamf Heroes Party:  Museum of Illusions Rocketman Tech Party: The 1Up Arcade Bar 2026 — Kansas City, MO J

Hello everyone,Anybody able to advice witch way to go to get Singel Sign-On for our Apple fleet? Is it with only Single Sign-On extension in Jamf, Kerberos SSO extension via Apples site or any other?

TitleHi Apple/Jamf admins,I purchased a MacBook Neo advertised and sold as brand new from a third-party seller.During initial setup, I discovered that the Mac is enrolled in Jamf/MDM and is showing organisation-management information. I was not informed before purchase that the device was managed by an organisation.I have contacted the seller and they have offered to exchange the device, but I’d like to understand what has happened before returning it.From an IT/admin perspective:What are the legitimate ways to determine whether the Mac is registered in Apple Business Manager/Automated Device Enrollment? How can I distinguish between a locally installed MDM profile and Automated Device Enrollment? If the device is in Apple Business Manager, does removing the MDM profile locally actually resolve the underlying enrollment? Can an Apple/Jamf administrator release the device from their organisation remotely? Could a genuinely unused/new Mac have been purchased by a reseller and subsequentl

We would like to request an enhancement to Jamf Self Service / Self Service+ for macOS to provide more dynamic application status and lifecycle management.The requested functionality is: Self Service should automatically detect whether an application is already installed on the Mac. Once the application is detected as installed, the Self Service item should automatically change its status from Install to Installed. For installed applications, Self Service should also provide a native Remove/Uninstall option without requiring administrators to create a separate uninstall policy, Smart Group, or custom script for each application. If the application is removed, Self Service should automatically detect the change and return the application to an Install state. Ideally, this status should update dynamically without depending on a full inventory update or jamf recon. The expected user experience would be:Application not installed:[ Install ]Application detected as installed:[ Instal

Hi everyone,I’m trying to set a default font in Microsoft Outlook (macOS) using Jamf Pro, and I’m running into some trouble.By default, Outlook uses Aptos, but I’d like to change it to Book Antique, which is already available on the device.What I’ve tried: I attempted to use the 3rd-party tool OutlookFontPoke by Paul Bowden @ Microsoft. Here’s what I did:• Deployed the OutlookFontPoke script and TemplateRegDB.reg via a package (both located in /private/tmp/OutlookFontPoke-master).• Created a policy in Jamf that:• Extracts the current logged-in user• Fixes permissions• Run the command as that user: sudo -u "$loggedInUser" /private/tmp/OutlookFontPoke-master/OutlookFontPoke 'Book Antique' '11.0pt' 'black' Issue: Despite several variations of the above, I keep getting this error in the script logs:WARNING: Registry DOES NOT exist at path /Library/Group Containers/UBF8T346G9.Office/MicrosoftRegistrationDB.reg. Attempting to create...mkdir: USER/Library/Group Containers: No such file or dir

We are a community of IT professionals, systems engineers, and broadcast technology specialists managing Apple devices across Belgium’s media and broadcasting sectors. Whether you are deploying Macs in live production environments, managing enterprise fleets with MDM, or integrating Apple hardware into specialized broadcast workflows, this is your place to collaborate.

It was so great to meet so many of you in person at JNUC!Thank you to Margaret, Kat, and Katie for presenting and facilitating the WIT Networking session. Margaret, it was so fun to run into you over and over, both in the session and everywhere else. Kat, thank you so much for not letting me minimize the honor it was to be selected to present. It was phenomenal to see Beth attending this session. Thank you to Beth for being the kind of leader who supports her team and community directly and in person. Thank you to Daniela for catching me in the vendor hall to give me a sticker. Thank you to Joanna for chatting with me about user groups and connecting with possible speaking/presenting opportunities.Thank you to everyone who attended my session and to everyone who will take the time to read the slides, get inspired, and implement workflows for accessibility and user experience in your own environments.Thank you all for being a community, to me and to each other. I genuinely feel like I a

Our infrastructure team is complaining about bandwidth congestion over the two 10 GBPS E-Lans.Has anyone moved from the 10 GBPS E-Lan to Dedicated Internet Access (DIA) or Cloud Connect to and experienced less congestion?

 Hi all,I'm testing macOS 27 Golden Gate (26A428) before fleet deployment and I'm trying to hide the VPN section from System Settings using the com.apple.systempreferences payload with the DisabledSystemSettings key.Bundle ID used: com.apple.NetworkExtensionSettingsUI.VpnSettingsIntents (confirmed via pluginkit -m -A -v | grep -i vpn)What I've tried:Deploying a native com.apple.systempreferences payload via Jamf Pro (uploaded as a full .mobileconfig) Running sudo defaults write /Library/Preferences/com.apple.systempreferences DisabledSystemSettings -array "com.apple.NetworkExtensionSettingsUI.VpnSettingsIntents" manuallyIn both cases the profile installs successfully and the key is present, but the VPN section remains visible in System Settings.This worked correctly on macOS 26 Tahoe. Has anyone found a working bundle ID or alternative approach for macOS 27?Thanks

Hello Jamf Nation! On October 1st, we made exciting updates to Jamf Premium Support (blog here: https://www.jamf.com/blog/jamf-premium-support-technical-account-managers/. You still get the same expert help from our internal support team, including Tier 3 support, enhanced target response times, and 24/7 access to support, but with some added benefits. Let’s look at the highlights: Premium Support Tiers:  There are now five tiers of Premium Support, with the addition of Premium Support Titanium   Technical Account Manager: A Technical Account Manager (TAM) adds proactive technical guidance to help plan and implement your Mac or mobile strategy. There are three different types of TAMs available, dependent on the Premium Support tier:  Collaborative TAM: These Jamfs provide proactive technical advice and guidance to help you configure your Jamf environment and implement industry best practices. Available with Premium Support Gold and Platinum.   Integrated TAM: These Jamfs help plan and

Dear Community,i stumble upon the Topic:  I am currently facing the notorious "Peak Storage Overhead" / Storage Bottleneck issue while trying to update our fleet of 700 iPads (8th Generation, 32GB models). Even after a factory wipe, the Over-the-Air (OTA) update fails due to the system data footprint taking up too much space on these 32GB devices.I stumbled upon the topic where @cr4sh0ver mentioned a solution:"We changed our 'PreStage Enrollment' to require the latest OS before enrollment is processed. iPads go through normal enrollment process after the iPad has been updated..."Since we are running Jamf School (not Jamf Pro), I am struggling to find this exact setting. I know that we don't have "PreStage Enrollments" by that name, but rather Automated Device Enrollment Profiles (DEP) and Blueprints.Could anyone give me a quick, detailed step-by-step walkthrough for Jamf School on how to replicate this fix for a single test device?Where exactly in the Jamf School DEP profile (or elsewh

I am trying to configure Content Caching with MacOS 27, and they deprecated the Content Caching through Configuration Profiles. The main goal is to automate ICS with iOS devices.I have a Blueprint setup, and I have enabled “Auto enable tethered caching” and set it to True. This will set the key “AutoEnableTetheredCaching” to 1. However, I don’t see a way to set “AllowTetheredCaching” to a 1 as well.Limited output from “defaults read /Library/Preferences/com.apple.AssetCache.plist”:    Activated = 1;    AllowCacheDelete = 1;    AllowPersonalCaching = 0;    AllowSharedCaching = 1;    AllowTetheredCaching = 0;    AutoActivation = 1;    AutoEnableTetheredCaching = 1;    CacheLimit = 0; 

I have a problem where some users are unable to enroll new devices in Jamf School. I use enrollment via Entra. After entering their email address and password, it just spins for a while and then returns to the Entra window saying, “You can’t sign in right now. Please try again.”When I check the sign-in logs in Entra, they show “successful” several times, but no failed attempts. However, this does not affect all users—some are able to sign in and enroll devices, which is what confuses me.Has anyone run into the same issue?

Environment:- Fleet of iPads enrolled as Shared iPad via Apple Business Manager- Managed via Microsoft Intune- Federated authentication with Microsoft Entra IDIssue:The "Recent Users" pre-sign-in screen (the screen shown before any user signs in, displaying recent user avatars) never times out or goes to sleep on its own, regardless of the Auto-Lock setting configured on the device. This causes the display to stay on indefinitely whenever the device is sitting at this screen, which is a significant battery drain concern for a shared-device fleet.Steps to reproduce:1. Enroll an iPad as Shared iPad via Apple Business Manager / Intune2. Sign out of any active user session so the device returns to the "Recent Users" screen3. Leave the device untouched at this screen4. Observe: the screen never dims or locks on its ownTesting done:- Tested with Auto-Lock set to 2 minutes on one device and 5 minutes on a second device- Both devices exhibited identical behavior: the Recent Users screen stayed